UpHeron
All vulnerabilities

Servers and applications

CVE-2017-12615

When running Apache Tomcat 7.0.0 to 7.0.79 on Windows with HTTP PUTs enabled (e.g. via setting the readonly initialisation parameter of the Default to false) it was possible to upload a JSP file to the server via a specially crafted request. This JSP could then be requested and any code it contained would be executed by the server.

Actively exploited: CISA added it to its Known Exploited Vulnerabilities catalog on 25 Mar 2022.

Severity
High 8.1
Published
19 Sept 2017
Last changed
6 Aug 2026
Added to UpHeron
21 Oct 2026
Sources
NVD

Affected software

SoftwareAffected versions
Apache TomcatServers and applications · cpe:a:apache:tomcat
  • From 7.0.0 up to 7.0.79

Known exploited

CISA name
Apache Tomcat on Windows Remote Code Execution Vulnerability
Required action
Apply updates per vendor instructions.
Due for US agencies
15 Apr 2022
Used in ransomware
Yes, known

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2017-12615
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2017-12615